> For the complete documentation index, see [llms.txt](https://docs.spice.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.spice.ai/docs/portal/organizations/organization-secrets.md).

# Organization Secrets

**Organization Secrets** are encrypted key-value pairs defined once for an organization and shared with the apps that need them. A shared credential — a warehouse password, a model provider API key — is stored in one place instead of being copied into every app that uses it.

An organization secret reaches an app only after it is linked to that app. Storing a secret at the organization level does not expose it to every app in the organization.

Once a secret is saved, its value cannot be read back through Spice Cloud. The portal lists only the secret name and when it was created or last updated.

### Access by role

The **Secrets** section is available to organization owners, admins, and members. Viewers cannot view or manage secrets, and the section is hidden from them.

| Role   | Organization secrets   |
| ------ | ---------------------- |
| Owner  | Create, update, delete |
| Admin  | Create, update, delete |
| Member | Create, update, delete |
| Viewer | No access              |

Roles are assigned per organization member. [Learn more about organizations.](/docs/portal/organizations.md)

### Create an organization secret

1. Select the organization from the application selector.
2. Navigate to the **Settings** tab and select the **Secrets** section.
3. Fill the **Name** and **Value** fields and click **Add**.

Secret names must start with a letter or an underscore and may contain only letters, numbers, and underscores, for example `GITHUB_TOKEN`.

### Update or delete a secret

Editing a secret replaces its value. The name cannot be changed — to rename a secret, create a new one and delete the old one.

Deleting a secret requires confirmation, and removes it from every app it is linked to.

### Link a secret to an app

1. Select the app.
2. Navigate to the **Settings** tab and select the **Secrets** section.
3. Under **Linked Organization Secrets**, select each secret the app should receive.
4. Click **Save linked secrets**.

Linked secrets are referenced in the Spicepod configuration exactly like app secrets, as `${secrets:<SECRET_NAME>}`:

```yaml
models:
  - from: openai:gpt-4o
    name: gpt-4o
    params:
      openai_api_key: ${secrets:OPENAI_API_KEY}
```

{% hint style="info" %}
When an app secret and a linked organization secret have the same name, the app secret takes precedence at runtime.
{% endhint %}

To apply a change to linked secrets, initiate a new Spicepod deployment. [Learn more about deployments.](/docs/portal/app-spicepod/deployments.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.spice.ai/docs/portal/organizations/organization-secrets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.